Secure your forms with Google reCAPTCHA protection

Prevent spam and bot submissions on your forms by adding a Google reCAPTCHA. This will ensure that the information you collect is authentic and that your form submissions are from real people.

ReCAPTCHA protection is available on Typeform for Growth plans.

You can jump to a section by clicking on the links below, or scroll down to read the full article:

What is reCAPTCHA?
How does it work?
How to enable reCAPTCHA protection on your forms
FAQ

What is reCAPTCHA?

reCAPTCHA is a Google service that helps protect websites from spam and abuse. A “CAPTCHA” is a test to differentiate humans from bots. It's easy for humans to solve, but hard for “bots” and other malicious software to answer correctly.

How does it work?

reCAPTCHA works by presenting users with tests to determine if they are human or bots. These tests can include solving puzzles or identifying objects in images. When a user completes the test successfully, they can proceed with their intended action, in this case, submitting the form.

How to enable reCAPTCHA protection on your forms

1. Create a new form or open an existing one.

2. Click the Settings button.

3. Under the General tab, scroll down to Preferences and toggle on reCAPTCHA protection.

4. Now you'll see the Basic prevention and Advanced prevention and management options. By default, Advanced prevention and management is selected, and we recommend using this option as it is a more seamless experience for your respondents.

5. Select the radio button next to your preferred option and hit Save.

6. If you've selected Advanced prevention, your respondents won't see a visual challenge when completing your form, but the spam responses (if any) submitted to your form will be displayed in a separate Spam folder in the Results tab.

7. If you've selected Basic prevention, when Google considers it necessary, respondents will be presented with a reCAPTCHA test after pressing the Submit button, before their form is submitted.

8. If they answer the test correctly, their form will be submitted.

FAQ

Do spam responses collected with advanced prevention count toward my response limit?

No, spam responses don't count toward your response limit, and they are not delivered via the API, webhooks, or integrations either.

Is there a limit on the number of spam messages I can receive?

Yes, you can collect a maximum of 1,000 spam messages per form. If a form is attacked by bots submitting more than 1,000 spam messages in a short time, the spam responses over the 1,000 limit won't be stored or visible anywhere.

What happens if a reCAPTCHA test is answered incorrectly?

A new test will be shown if a reCAPTCHA test is answered incorrectly. The form will only be submitted when the test is successfully resolved. The form won't be submitted if the respondent fails to answer the test correctly.

Can reCAPTCHA be enabled for all my forms on an account level?

No, reCAPTCHA can only be enabled on a form-level basis. This means that you need to enable it separately for each form you want to have reCAPTCHA protection.

Are reCAPTCHA tests shown each time a respondent tries to submit a form?

No. reCAPTCHA tests are shown as needed. Google determines whether to display the reCAPTCHA based on various factors such as IP address, environment, device, and other known variables.

As a respondent engages with a form that has reCAPTCHA enabled, reCAPTCHA will continuously gather information to determine if they are a human or a bot. This allows reCAPTCHA to decide whether to prompt a test or not.

Can I view information about pass and fail rates on reCAPTCHA tests?

No, you can't see information about pass and fail rates on reCAPTCHA tests at this time.

Can I turn on reCAPTCHA on an account level for all my forms?

No, reCAPTCHA must be enabled on a per-form basis.

How can I test reCAPTCHA?

To test reCAPTCHA, use incognito mode or try switching devices. However, keep in mind that Google may stop showing CAPTCHA once they learn about you.